Skip to main content

​
Overview

Azalt supports file storage via:
  • AWS S3 (default)
  • S3-compatible services (MinIO, private cloud S3, etc.)
File storage is optional. If not configured, file upload features will be disabled.

​
Environment Variables

​
Required for File Storage

​
Optional Configuration

​
Configuration Scenarios

​
AWS S3 (Standard)

For standard AWS S3, only the basic credentials are needed:
The AWS SDK automatically uses public AWS endpoints. No S3_ENDPOINT or S3_PUBLIC_ENDPOINT needed.

​
MinIO (Browser-Accessible)

If your MinIO instance is directly accessible from browsers (e.g., exposed via public IP or domain):
No S3_PUBLIC_ENDPOINT needed since S3_ENDPOINT is browser-accessible.

​
MinIO (Docker/Kubernetes Internal)

If MinIO is only accessible internally (e.g., Docker network or Kubernetes cluster):

​
Private Cloud S3

For internal S3-compatible storage in private clouds (e.g., bank infrastructure):
If your internal S3 endpoint is accessible from browsers (e.g., users are on VPN), you can omit S3_PUBLIC_ENDPOINT.

​
How Presigned URLs Work

When a user uploads or downloads a file, Azalt generates a presigned URL that the browser uses directly.

​
Endpoint Resolution Order

For presigned URLs (browser file access):
  1. S3_PUBLIC_ENDPOINT if set
  2. S3_ENDPOINT if set
  3. AWS SDK defaults (for standard AWS S3)
For server operations (uploads, validation):
  1. S3_ENDPOINT if set
  2. AWS SDK defaults

​
Helm Values (Kubernetes)

In values.yaml:

​
Troubleshooting

Ensure all three required variables are set:
  • S3_BUCKET_NAME
  • S3_ACCESS_KEY_ID
  • S3_SECRET_ACCESS_KEY
This warning appears when S3_ENDPOINT is configured but S3_PUBLIC_ENDPOINT is not. The app will use S3_ENDPOINT for presigned URLs.Action needed if: S3_ENDPOINT is an internal URL (Docker/Kubernetes service name) that browsers cannot reach. Set S3_PUBLIC_ENDPOINT to the browser-accessible URL.No action needed if: S3_ENDPOINT is already browser-accessible (users on VPN, public endpoint, etc.).
This usually means there’s a mismatch between the URL used for signing and the URL browsers actually access.
  1. Verify S3_PUBLIC_ENDPOINT points to where browsers can reach S3
  2. Check that any reverse proxy preserves the path correctly
  3. Ensure S3_FORCE_PATH_STYLE matches your S3 service requirements
Ensure your S3 bucket has proper CORS configuration allowing requests from your application domain.